🔴 Critical: Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
-
CISA has added a critical Fortinet FortiMail vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation in the wild. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8, placing it in the critical severity range.
The vulnerability allows unauthenticated attackers to write arbitrary files on the underlying system. CISA's addition of the flaw to the KEV catalog confirms that threat actors are actively targeting it, making patching a priority for affected organizations.
Given the unauthenticated nature of the attack vector and the potential for arbitrary file writes to lead to further compromise, administrators running FortiMail should treat this as an urgent item. Review your exposure, apply available fixes from Fortinet, and monitor for signs of exploitation.
Source: The Hacker News
Has your organization deployed FortiMail, and if so, what steps are you taking to address this actively exploited flaw?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login